@iowarp/clio-coder 0.3.9 → 0.4.1

package/dist/chunk-6CCS4G3W.js

@@ -0,0 +1,1529 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  assertSafeId
+} from "./chunk-R346GLFC.js";
+import {
+  safeResourceWrite
+} from "./chunk-WEPFGWHJ.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/domains/eval/schema/execution-envelope.ts
+init_esm_shims();
+
+// src/domains/eval/schema/naming.ts
+init_esm_shims();
+function normalizeEvalSchemaId(value) {
+  return typeof value === "string" && value.startsWith("clio.eval.") ? `clio-coder.eval.${value.slice("clio.eval.".length)}` : value;
+}
+function normalizeEvalRunnerKind(value) {
+  return value === "clio-run" ? "clio-coder-run" : value;
+}
+
+// src/domains/eval/schema/execution-envelope.ts
+var EVAL_EXECUTION_ENVELOPE_SCHEMA_V1 = "clio-coder.eval.execution-envelope.v1";
+var EVAL_EXECUTION_MATRIX_DIMENSIONS_V1 = [
+  "prompt",
+  "recipe",
+  "target",
+  "wireModel",
+  "runtime",
+  "thinkingLevel",
+  "toolSignature",
+  "autonomy",
+  "policy",
+  "projectContext",
+  "corpus"
+];
+function parseEvalExecutionEnvelopeV1(value, source = "execution envelope") {
+  const record = asRecord(value, source);
+  if (normalizeEvalSchemaId(record.schema) !== EVAL_EXECUTION_ENVELOPE_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_EXECUTION_ENVELOPE_SCHEMA_V1}`);
+  }
+  const prompt = asRecord(record.prompt, `${source}.prompt`);
+  if (!Array.isArray(prompt.fragments)) throw new Error(`${source}.prompt.fragments: expected array`);
+  const fragments = prompt.fragments.map((entry, index) => {
+    const fragment = asRecord(entry, `${source}.prompt.fragments[${index}]`);
+    const version = fragment.version;
+    if (version !== "unversioned" && (!Number.isInteger(version) || typeof version !== "number" || version <= 0)) {
+      throw new Error(`${source}.prompt.fragments[${index}].version: expected positive integer or unversioned`);
+    }
+    return {
+      id: readString(fragment.id, `${source}.prompt.fragments[${index}].id`),
+      version,
+      contentHash: readDigest(fragment.contentHash, `${source}.prompt.fragments[${index}].contentHash`)
+    };
+  });
+  const fragmentIds = fragments.map((fragment) => fragment.id);
+  if (new Set(fragmentIds).size !== fragmentIds.length) {
+    throw new Error(`${source}.prompt.fragments: duplicate fragment id`);
+  }
+  const recipe = record.recipe === null ? null : (() => {
+    const value2 = asRecord(record.recipe, `${source}.recipe`);
+    const version = value2.version;
+    if (!Number.isInteger(version) || typeof version !== "number" || version <= 0) {
+      throw new Error(`${source}.recipe.version: expected positive integer`);
+    }
+    return {
+      id: readString(value2.id, `${source}.recipe.id`),
+      version,
+      contentHash: readDigest(value2.contentHash, `${source}.recipe.contentHash`)
+    };
+  })();
+  const policyHashes = asRecord(record.policyHashes, `${source}.policyHashes`);
+  const projectContext = asRecord(record.projectContext, `${source}.projectContext`);
+  const projectKind = projectContext.kind;
+  if (projectKind !== "none" && projectKind !== "session" && projectKind !== "worker") {
+    throw new Error(`${source}.projectContext.kind: expected none, session, or worker`);
+  }
+  const corpus = asRecord(record.corpus, `${source}.corpus`);
+  return {
+    schema: EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+    prompt: {
+      fragments,
+      compositionHash: readNullableDigest(prompt.compositionHash, `${source}.prompt.compositionHash`)
+    },
+    recipe,
+    target: readString(record.target, `${source}.target`),
+    wireModel: readNullableString(record.wireModel, `${source}.wireModel`),
+    runtime: readNullableString(record.runtime, `${source}.runtime`),
+    thinkingLevel: readNullableString(record.thinkingLevel, `${source}.thinkingLevel`),
+    toolSignature: readNullableDigest(record.toolSignature, `${source}.toolSignature`),
+    autonomy: readNullableString(record.autonomy, `${source}.autonomy`),
+    policyHashes: {
+      rulePack: readNullableDigest(policyHashes.rulePack, `${source}.policyHashes.rulePack`),
+      project: readNullableDigest(policyHashes.project, `${source}.policyHashes.project`)
+    },
+    projectContext: {
+      kind: projectKind,
+      tier: readNullableString(projectContext.tier, `${source}.projectContext.tier`),
+      contentHash: readNullableDigest(projectContext.contentHash, `${source}.projectContext.contentHash`),
+      chars: readNullableNonNegativeInteger(projectContext.chars, `${source}.projectContext.chars`),
+      sections: readStringArray(projectContext.sections, `${source}.projectContext.sections`),
+      rulesApplied: readStringArray(projectContext.rulesApplied, `${source}.projectContext.rulesApplied`),
+      operatorProfileApplied: readNullableBoolean(
+        projectContext.operatorProfileApplied,
+        `${source}.projectContext.operatorProfileApplied`
+      )
+    },
+    corpus: {
+      id: readString(corpus.id, `${source}.corpus.id`),
+      version: readString(corpus.version, `${source}.corpus.version`)
+    }
+  };
+}
+function parseEvalExecutionMatrixDimensionsV1(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  const allowed = new Set(EVAL_EXECUTION_MATRIX_DIMENSIONS_V1);
+  const dimensions = value.map((entry, index) => {
+    if (typeof entry !== "string" || !allowed.has(entry)) {
+      throw new Error(`${source}[${index}]: expected a declared execution-envelope dimension`);
+    }
+    return entry;
+  });
+  if (new Set(dimensions).size !== dimensions.length) throw new Error(`${source}: duplicate matrix dimension`);
+  return dimensions;
+}
+function readString(value, source) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected non-empty string`);
+  return value;
+}
+function readNullableString(value, source) {
+  if (value === null) return null;
+  return readString(value, source);
+}
+function readDigest(value, source) {
+  const digest = readString(value, source);
+  if (!/^[a-f0-9]{64}$/u.test(digest)) throw new Error(`${source}: expected sha256 digest`);
+  return digest;
+}
+function readNullableDigest(value, source) {
+  return value === null ? null : readDigest(value, source);
+}
+function readNullableNonNegativeInteger(value, source) {
+  if (value === null) return null;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new Error(`${source}: expected non-negative integer or null`);
+  }
+  return value;
+}
+function readNullableBoolean(value, source) {
+  if (value === null || typeof value === "boolean") return value;
+  throw new Error(`${source}: expected boolean or null`);
+}
+function readStringArray(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  const entries = value.map((entry, index) => readString(entry, `${source}[${index}]`));
+  if (new Set(entries).size !== entries.length) throw new Error(`${source}: duplicate value`);
+  return entries;
+}
+function asRecord(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/schema/serving.ts
+init_esm_shims();
+function parseEvalServingConfigurationV1(value, source) {
+  const record = asRecord2(value, source);
+  const targetId = readString2(record.targetId, `${source}.targetId`);
+  const totalSlots = record.total_slots;
+  if (totalSlots !== null && (typeof totalSlots !== "number" || !Number.isInteger(totalSlots) || totalSlots <= 0)) {
+    throw new Error(`${source}.total_slots: expected positive integer or null`);
+  }
+  const compiledPromptHash = readNullableString2(record.compiledPromptHash, `${source}.compiledPromptHash`);
+  if (compiledPromptHash !== null && !/^[a-f0-9]{64}$/u.test(compiledPromptHash)) {
+    throw new Error(`${source}.compiledPromptHash: expected sha256 digest or null`);
+  }
+  return {
+    targetId,
+    runtimeId: readNullableString2(record.runtimeId, `${source}.runtimeId`),
+    modelId: readNullableString2(record.modelId, `${source}.modelId`),
+    serverBuild: readNullableString2(record.serverBuild, `${source}.serverBuild`),
+    total_slots: totalSlots,
+    thinkingLevel: readNullableString2(record.thinkingLevel, `${source}.thinkingLevel`),
+    compiledPromptHash
+  };
+}
+function evalServingConfigurationOf(artifact) {
+  return artifact.servingConfiguration ?? {
+    targetId: artifact.matrix.target,
+    runtimeId: null,
+    modelId: artifact.matrix.model,
+    serverBuild: null,
+    total_slots: null,
+    thinkingLevel: artifact.matrix.thinking,
+    compiledPromptHash: null
+  };
+}
+function sameEvalServingConfiguration(left, right) {
+  return left.targetId === right.targetId && left.runtimeId === right.runtimeId && left.modelId === right.modelId && left.serverBuild === right.serverBuild && left.total_slots === right.total_slots && left.thinkingLevel === right.thinkingLevel && left.compiledPromptHash === right.compiledPromptHash;
+}
+function renderEvalServingConfiguration(config) {
+  return [
+    `target=${config.targetId}`,
+    `runtime=${config.runtimeId ?? "unknown"}`,
+    `model=${config.modelId ?? "unknown"}`,
+    `server_build=${config.serverBuild ?? "unknown"}`,
+    `total_slots=${config.total_slots ?? "unknown"}`,
+    `thinking=${config.thinkingLevel ?? "unknown"}`,
+    `compiled_prompt_hash=${config.compiledPromptHash ?? "unknown"}`
+  ].join(" ");
+}
+function readString2(value, source) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected string`);
+  return value;
+}
+function readNullableString2(value, source) {
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}: expected string or null`);
+  return value;
+}
+function asRecord2(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/harness-metrics.ts
+init_esm_shims();
+var ZERO_EVAL_HARNESS_METRICS = {
+  receiptCount: 0,
+  toolCalls: 0,
+  retries: 0,
+  safetyBlocks: 0,
+  correctionLatencyMs: 0,
+  validationEvidence: 0
+};
+function evalHarnessMetricsFromCommands(commands) {
+  return {
+    ...ZERO_EVAL_HARNESS_METRICS,
+    validationEvidence: commands.filter(
+      (command) => command.phase === "verifier" && command.exitCode === 0 && !command.timedOut
+    ).length
+  };
+}
+function evalHarnessMetricsFromReceipt(receipt, extras = {}) {
+  return {
+    receiptCount: 1,
+    toolCalls: receipt.toolCalls,
+    retries: extras.retries ?? 0,
+    safetyBlocks: receipt.safety?.decisions.blocked ?? 0,
+    correctionLatencyMs: extras.correctionLatencyMs ?? 0,
+    validationEvidence: extras.validationEvidence ?? 0
+  };
+}
+function sumEvalHarnessMetrics(records) {
+  return records.reduce((total, record) => addEvalHarnessMetrics(total, record.harness), {
+    ...ZERO_EVAL_HARNESS_METRICS
+  });
+}
+function addEvalHarnessMetrics(left, right) {
+  return {
+    receiptCount: left.receiptCount + right.receiptCount,
+    toolCalls: left.toolCalls + right.toolCalls,
+    retries: left.retries + right.retries,
+    safetyBlocks: left.safetyBlocks + right.safetyBlocks,
+    correctionLatencyMs: left.correctionLatencyMs + right.correctionLatencyMs,
+    validationEvidence: left.validationEvidence + right.validationEvidence
+  };
+}
+
+// src/domains/eval/store.ts
+init_esm_shims();
+import { createHash, randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// src/domains/eval/artifacts/redact.ts
+init_esm_shims();
+var SENSITIVE_KEY = /(?:^|[_-])(api[_-]?key|authorization|cookie|password|secret|token)(?:$|[_-])/i;
+var CREDENTIAL_PATTERNS = [
+  [/\b(authorization\s*[:=]\s*)(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1[redacted]"],
+  [/\b(bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi, "$1[redacted]"],
+  [/\b(sk-[A-Za-z0-9_-]{16,})\b/g, "[redacted]"],
+  [/\b(gh[pousr]_[A-Za-z0-9_]{16,})\b/g, "[redacted]"],
+  [/\b(AKIA[0-9A-Z]{16})\b/g, "[redacted]"],
+  [/\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|secret)\s*[:=]\s*)[^\s"',}]+/gi, "$1[redacted]"]
+];
+function redactArtifactForStorage(value, env = process.env) {
+  return redactValue(value, env);
+}
+function redactValue(value, env) {
+  if (typeof value === "string") return redactString(value, env);
+  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, env));
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = SENSITIVE_KEY.test(key) ? "[redacted]" : redactValue(entry, env);
+    }
+    return out;
+  }
+  return value;
+}
+function redactString(value, env) {
+  let out = stripHomePrefix(value, env.HOME);
+  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+function stripHomePrefix(value, home) {
+  if (home === void 0 || home.length === 0) return value;
+  const normalized = home.replace(/\/+$/g, "");
+  if (normalized.length === 0) return value;
+  return value.split(normalized).join("$HOME");
+}
+
+// src/domains/eval/store.ts
+var NODE_SIGNALS = /* @__PURE__ */ new Set([
+  "SIGHUP",
+  "SIGINT",
+  "SIGQUIT",
+  "SIGILL",
+  "SIGTRAP",
+  "SIGABRT",
+  "SIGIOT",
+  "SIGBUS",
+  "SIGFPE",
+  "SIGKILL",
+  "SIGUSR1",
+  "SIGSEGV",
+  "SIGUSR2",
+  "SIGPIPE",
+  "SIGALRM",
+  "SIGTERM",
+  "SIGCHLD",
+  "SIGSTKFLT",
+  "SIGCONT",
+  "SIGSTOP",
+  "SIGTSTP",
+  "SIGTTIN",
+  "SIGTTOU",
+  "SIGURG",
+  "SIGXCPU",
+  "SIGXFSZ",
+  "SIGVTALRM",
+  "SIGPROF",
+  "SIGWINCH",
+  "SIGIO",
+  "SIGPOLL",
+  "SIGPWR",
+  "SIGSYS",
+  "SIGUNUSED"
+]);
+function evalRoot(dataDir) {
+  return join(dataDir, "evals");
+}
+function evalArtifactPath(dataDir, evalId) {
+  assertSafeId(evalId, "eval");
+  return join(evalRoot(dataDir), `${evalId}.json`);
+}
+function createEvalId(startedAt, taskFileHash) {
+  const stamp = startedAt.toISOString().replace(/[-:.]/g, "");
+  return `eval-${stamp}-${taskFileHash.slice(0, 8)}-${randomBytes(6).toString("hex")}`;
+}
+async function writeEvalArtifact(dataDir, artifact) {
+  const path = evalArtifactPath(dataDir, artifact.evalId);
+  const redacted = redactArtifactForStorage({
+    ...artifact,
+    paths: { ...artifact.paths, artifact: path }
+  });
+  safeResourceWrite(path, `${JSON.stringify(redacted, null, 2)}
+`, { encoding: "utf8" });
+  return path;
+}
+async function loadEvalArtifact(dataDir, evalId) {
+  let raw;
+  try {
+    raw = await readFile(evalArtifactPath(dataDir, evalId), "utf8");
+  } catch (error) {
+    if (isErrorWithCode(error) && error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
+    throw error;
+  }
+  const source = evalArtifactPath(dataDir, evalId);
+  const parsed = parseJson(raw, source);
+  return parseArtifact(parsed, source);
+}
+function parseArtifact(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  if (value.version !== 1) throw new Error(`${source}.version: expected 1`);
+  const results = readArray(value, source, "results").map(
+    (entry, index) => parseRecord(entry, `${source}.results[${index}]`)
+  );
+  return {
+    version: 1,
+    evalId: readString3(value, source, "evalId"),
+    taskFile: readString3(value, source, "taskFile"),
+    taskFileHash: readString3(value, source, "taskFileHash"),
+    clioCoder: parseClioProvenance(readEvalProvenance(value, source), `${source}.clioCoder`),
+    environment: parseEnvironmentProvenance(
+      readRequiredArtifactField(value, source, "environment"),
+      `${source}.environment`
+    ),
+    target: readOptionalNullableString(value, source, "target"),
+    model: readOptionalNullableString(value, source, "model"),
+    thinking: readOptionalNullableString(value, source, "thinking"),
+    paths: parseArtifactPaths(readRequiredArtifactField(value, source, "paths"), `${source}.paths`),
+    repeat: readNumber(value, source, "repeat"),
+    startedAt: readString3(value, source, "startedAt"),
+    endedAt: readString3(value, source, "endedAt"),
+    summary: parseSummary(value.summary, `${source}.summary`),
+    results
+  };
+}
+function parseSummary(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  return {
+    runs: readNumber(value, source, "runs"),
+    passed: readNumber(value, source, "passed"),
+    failed: readNumber(value, source, "failed"),
+    passRate: readNumber(value, source, "passRate"),
+    tokens: readNumber(value, source, "tokens"),
+    costUsd: readNumber(value, source, "costUsd"),
+    wallTimeMs: readNumber(value, source, "wallTimeMs"),
+    harness: value.harness === void 0 ? { ...ZERO_EVAL_HARNESS_METRICS } : parseHarnessMetrics(value.harness, `${source}.harness`),
+    failureClasses: readArray(value, source, "failureClasses").map(
+      (entry, index) => parseFailureClassCount(entry, `${source}.failureClasses[${index}]`)
+    )
+  };
+}
+function parseRecord(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  const failureClass = readOptionalFailureClass(value, source, "failureClass");
+  const commands = readArray(value, source, "commands").map(
+    (entry, index) => parseCommand(entry, `${source}.commands[${index}]`)
+  );
+  const record = {
+    taskId: readString3(value, source, "taskId"),
+    runId: readString3(value, source, "runId"),
+    repeatIndex: readNumber(value, source, "repeatIndex"),
+    cwd: readString3(value, source, "cwd"),
+    prompt: readString3(value, source, "prompt"),
+    tags: readStringArray2(value, source, "tags"),
+    pass: readBoolean(value, source, "pass"),
+    exitCode: readNumber(value, source, "exitCode"),
+    tokens: readNumber(value, source, "tokens"),
+    costUsd: readNumber(value, source, "costUsd"),
+    wallTimeMs: readNumber(value, source, "wallTimeMs"),
+    harness: value.harness === void 0 ? evalHarnessMetricsFromCommands(commands) : parseHarnessMetrics(value.harness, `${source}.harness`),
+    commands
+  };
+  if (failureClass !== void 0) record.failureClass = failureClass;
+  const receiptPath = readOptionalString(value, source, "receiptPath");
+  if (receiptPath !== void 0) record.receiptPath = receiptPath;
+  const evidenceId = readOptionalString(value, source, "evidenceId");
+  if (evidenceId !== void 0) record.evidenceId = evidenceId;
+  const paths = value.paths === void 0 ? void 0 : parseRunPaths(value.paths, `${source}.paths`);
+  if (paths !== void 0) record.paths = paths;
+  return record;
+}
+function parseClioProvenance(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  return {
+    version: readString3(value, source, "version"),
+    commit: readNullableString3(value, source, "commit"),
+    entry: readString3(value, source, "entry")
+  };
+}
+function parseEnvironmentProvenance(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  return {
+    platform: readString3(value, source, "platform"),
+    node: readString3(value, source, "node")
+  };
+}
+function parseArtifactPaths(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  const out = {
+    taskFile: readString3(value, source, "taskFile"),
+    receipts: readStringArray2(value, source, "receipts"),
+    sessionLedgers: readStringArray2(value, source, "sessionLedgers")
+  };
+  const artifact = readOptionalString(value, source, "artifact");
+  if (artifact !== void 0) out.artifact = artifact;
+  const evidence = readOptionalString(value, source, "evidence");
+  if (evidence !== void 0) out.evidence = evidence;
+  return out;
+}
+function parseRunPaths(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  const out = {};
+  const receipt = readOptionalString(value, source, "receipt");
+  if (receipt !== void 0) out.receipt = receipt;
+  const sessionLedger = readOptionalString(value, source, "sessionLedger");
+  if (sessionLedger !== void 0) out.sessionLedger = sessionLedger;
+  const evidence = readOptionalString(value, source, "evidence");
+  if (evidence !== void 0) out.evidence = evidence;
+  return out;
+}
+function readRequiredArtifactField(record, source, field) {
+  const value = record[field];
+  if (value === void 0) {
+    throw new Error(
+      `eval artifact has an invalid schema: missing required field '${field}' in ${source}. Re-run the evaluation suite to generate a complete artifact.`
+    );
+  }
+  return value;
+}
+function readEvalProvenance(record, source) {
+  const value = record.clioCoder ?? record.clio;
+  if (value === void 0) {
+    throw new Error(
+      `eval artifact has an invalid schema: missing required field 'clioCoder' in ${source}. Re-run the evaluation suite to generate a complete artifact.`
+    );
+  }
+  return value;
+}
+function parseHarnessMetrics(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  return {
+    receiptCount: readNumber(value, source, "receiptCount"),
+    toolCalls: readNumber(value, source, "toolCalls"),
+    retries: readNumber(value, source, "retries"),
+    safetyBlocks: readNumber(value, source, "safetyBlocks"),
+    correctionLatencyMs: readNumber(value, source, "correctionLatencyMs"),
+    validationEvidence: readNumber(value, source, "validationEvidence")
+  };
+}
+function parseCommand(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  const phase = readString3(value, source, "phase");
+  if (phase !== "setup" && phase !== "verifier") throw new Error(`${source}.phase: expected setup or verifier`);
+  return {
+    phase,
+    index: readNumber(value, source, "index"),
+    command: readString3(value, source, "command"),
+    exitCode: readNumber(value, source, "exitCode"),
+    signal: readSignal(value.signal, `${source}.signal`),
+    timedOut: readBoolean(value, source, "timedOut"),
+    wallTimeMs: readNumber(value, source, "wallTimeMs"),
+    stdout: readStringAllowEmpty(value, source, "stdout"),
+    stderr: readStringAllowEmpty(value, source, "stderr")
+  };
+}
+function readSignal(value, source) {
+  if (value === null) return null;
+  if (typeof value === "string" && NODE_SIGNALS.has(value)) return value;
+  throw new Error(`${source}: expected signal or null`);
+}
+function parseFailureClassCount(value, source) {
+  if (!isRecord(value)) throw new Error(`${source}: expected object`);
+  return {
+    failureClass: readFailureClass(value, source, "failureClass"),
+    count: readNumber(value, source, "count")
+  };
+}
+function readFailureClass(record, source, field) {
+  const value = record[field];
+  if (value === "setup_failed" || value === "verifier_failed" || value === "timeout" || value === "cwd_missing" || value === "command_error") {
+    return value;
+  }
+  throw new Error(`${source}.${field}: expected failure class`);
+}
+function readOptionalFailureClass(record, source, field) {
+  if (record[field] === void 0) return void 0;
+  return readFailureClass(record, source, field);
+}
+function readString3(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readStringAllowEmpty(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "string") throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readOptionalString(record, source, field) {
+  const value = record[field];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readNullableString3(record, source, field) {
+  const value = record[field];
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
+  return value;
+}
+function readOptionalNullableString(record, source, field) {
+  const value = record[field];
+  if (value === void 0 || value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
+  return value;
+}
+function readStringArray2(record, source, field) {
+  const value = readArray(record, source, field);
+  const out = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const entry = value[index];
+    if (typeof entry !== "string") throw new Error(`${source}.${field}[${index}]: expected string`);
+    out.push(entry);
+  }
+  return out;
+}
+function readNumber(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
+  return value;
+}
+function readBoolean(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
+  return value;
+}
+function readArray(record, source, field) {
+  const value = record[field];
+  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
+  return value;
+}
+function parseJson(raw, source) {
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`${source}: invalid JSON: ${message}`);
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isErrorWithCode(error) {
+  return error instanceof Error && "code" in error && typeof error.code === "string";
+}
+
+// src/domains/eval/artifacts/store.ts
+init_esm_shims();
+import { readFile as readFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+
+// src/domains/eval/schema/behavioral.ts
+init_esm_shims();
+import { createHash as createHash2 } from "node:crypto";
+
+// src/domains/eval/schema/verdict.ts
+init_esm_shims();
+var EVAL_VERDICT_SCHEMA_V1 = "clio-coder.eval.verdict.v1";
+var EVAL_TRACKED_METRIC_NAMES = [
+  "modelCalls",
+  "uncachedPrefillTokens",
+  "cacheReadTokens",
+  "generatedTokens",
+  "reasoningTokens",
+  "toolCalls",
+  "toolErrors",
+  "ttftMsFirstCall",
+  "wallClockMs",
+  "contextTokensAtEnd",
+  "compactions"
+];
+function parseEvalVerdictEnvelopeV1(value, source = "verdict") {
+  const record = asRecord3(value, source);
+  if (normalizeEvalSchemaId(record.schema) !== EVAL_VERDICT_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_VERDICT_SCHEMA_V1}`);
+  }
+  const scenarioId = readNonEmptyString(record, source, "scenarioId");
+  const trialIndex = readNonNegativeInteger(record, source, "trialIndex");
+  const outcome = readOutcome(record.outcome, `${source}.outcome`);
+  const machinery = readMachinery(record.machinery, `${source}.machinery`);
+  if (machinery === "infrastructure_failure" && outcome === "pass") {
+    throw new Error(`${source}: infrastructure_failure cannot carry a pass outcome`);
+  }
+  if (record.behavioral !== null) throw new Error(`${source}.behavioral: expected null in verdict v1`);
+  const evidence = parseEvidence(record.evidence, `${source}.evidence`);
+  const reason = record.reason === void 0 ? legacyVerdictReason(outcome, machinery, evidence) : readNullableNonEmptyString(record, source, "reason");
+  if (outcome === "fail" && reason === null) throw new Error(`${source}.reason: failed outcome requires a reason`);
+  if (outcome !== "fail" && reason !== null) {
+    throw new Error(`${source}.reason: only a failed outcome can carry a reason`);
+  }
+  return {
+    schema: EVAL_VERDICT_SCHEMA_V1,
+    scenarioId,
+    trialIndex,
+    outcome,
+    machinery,
+    reason,
+    trackedMetrics: parseTrackedMetrics(record.trackedMetrics, `${source}.trackedMetrics`),
+    behavioral: null,
+    evidence
+  };
+}
+function parseTrackedMetrics(value, source) {
+  const record = asRecord3(value, source);
+  const expectedColdReasons = asRecord3(record.expectedColdReasons, `${source}.expectedColdReasons`);
+  return {
+    modelCalls: readSourcedNumber(record.modelCalls, `${source}.modelCalls`),
+    uncachedPrefillTokens: readSourcedNumber(record.uncachedPrefillTokens, `${source}.uncachedPrefillTokens`),
+    cacheReadTokens: readSourcedNumber(record.cacheReadTokens, `${source}.cacheReadTokens`),
+    generatedTokens: readSourcedNumber(record.generatedTokens, `${source}.generatedTokens`),
+    reasoningTokens: readSourcedNullableNumber(record.reasoningTokens, `${source}.reasoningTokens`),
+    toolCalls: readSourcedNumber(record.toolCalls, `${source}.toolCalls`),
+    toolErrors: readSourcedNumber(record.toolErrors, `${source}.toolErrors`),
+    ttftMsFirstCall: readSourcedNumber(record.ttftMsFirstCall, `${source}.ttftMsFirstCall`),
+    wallClockMs: readSourcedNumber(record.wallClockMs, `${source}.wallClockMs`),
+    contextTokensAtEnd: readSourcedNumber(record.contextTokensAtEnd, `${source}.contextTokensAtEnd`),
+    compactions: readSourcedNumber(record.compactions, `${source}.compactions`),
+    expectedColdReasons: Object.fromEntries(
+      Object.entries(expectedColdReasons).map(([reason, metric]) => {
+        if (reason.trim().length === 0) throw new Error(`${source}.expectedColdReasons: expected non-empty reason`);
+        return [reason, readSourcedNumber(metric, `${source}.expectedColdReasons.${reason}`)];
+      })
+    )
+  };
+}
+function parseEvidence(value, source) {
+  const record = asRecord3(value, source);
+  const terminalReceiptDigest = readNullableString4(record, source, "terminalReceiptDigest");
+  if (terminalReceiptDigest !== null && !/^[a-f0-9]{64}$/u.test(terminalReceiptDigest)) {
+    throw new Error(`${source}.terminalReceiptDigest: expected sha256 digest or null`);
+  }
+  const graderExitCode = record.graderExitCode;
+  if (graderExitCode !== null && (!Number.isInteger(graderExitCode) || !Number.isFinite(graderExitCode))) {
+    throw new Error(`${source}.graderExitCode: expected integer or null`);
+  }
+  return {
+    assignmentId: readNullableString4(record, source, "assignmentId"),
+    terminalReceiptDigest,
+    graderExitCode
+  };
+}
+function legacyVerdictReason(outcome, machinery, evidence) {
+  if (outcome !== "fail") return null;
+  if (machinery === "infrastructure_failure") return "infrastructure_failure";
+  if (evidence.graderExitCode !== null && evidence.graderExitCode !== 0) return "grader_failed";
+  return "outcome_failed";
+}
+function readSourcedNumber(value, source) {
+  const record = asRecord3(value, source);
+  return {
+    value: readNonNegativeNumber(record.value, `${source}.value`),
+    source: readMetricSource(record.source, source)
+  };
+}
+function readSourcedNullableNumber(value, source) {
+  const record = asRecord3(value, source);
+  return {
+    value: record.value === null ? null : readNonNegativeNumber(record.value, `${source}.value`),
+    source: readMetricSource(record.source, source)
+  };
+}
+function readMetricSource(value, source) {
+  if (value === "ledger" || value === "receipt" || value === "estimated") return value;
+  throw new Error(`${source}.source: expected ledger, receipt, or estimated`);
+}
+function readOutcome(value, source) {
+  if (value === "pass" || value === "fail" || value === "unmeasured") return value;
+  throw new Error(`${source}: expected pass, fail, or unmeasured`);
+}
+function readMachinery(value, source) {
+  if (value === "ok" || value === "infrastructure_failure") return value;
+  throw new Error(`${source}: expected ok or infrastructure_failure`);
+}
+function readNonNegativeNumber(value, source) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new Error(`${source}: expected non-negative number`);
+  }
+  return value;
+}
+function readNonNegativeInteger(record, source, field) {
+  const value = record[field];
+  if (!Number.isInteger(value) || typeof value !== "number" || value < 0) {
+    throw new Error(`${source}.${field}: expected non-negative integer`);
+  }
+  return value;
+}
+function readNonEmptyString(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readNullableString4(record, source, field) {
+  const value = record[field];
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
+  return value;
+}
+function readNullableNonEmptyString(record, source, field) {
+  const value = readNullableString4(record, source, field);
+  if (value !== null && value.trim().length === 0) {
+    throw new Error(`${source}.${field}: expected non-empty string or null`);
+  }
+  return value;
+}
+function asRecord3(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+
+// src/domains/eval/schema/behavioral.ts
+var EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1 = "clio-coder.eval.scenario.v1";
+var EVAL_BEHAVIOR_SCHEMA_V1 = "clio-coder.eval.behavior.v1";
+var EVAL_BEHAVIOR_CATEGORIES = [
+  "tool_choice",
+  "exploration",
+  "delegation",
+  "safety_comprehension",
+  "claim_grounding",
+  "denied_tool_recovery",
+  "completion_behavior",
+  "task_correctness"
+];
+var MAX_RULES = 64;
+var MAX_FACTS = 128;
+var MAX_EVIDENCE_PER_LABEL = 8;
+var MAX_ID_CHARS = 128;
+var MAX_TEXT_CHARS = 1e3;
+var MAX_EXPLANATION_CHARS = 2e3;
+function parseEvalBehaviorScenarioV1(value, source = "behavioral scenario") {
+  const record = asRecord4(value, source);
+  if (normalizeEvalSchemaId(record.schema) !== EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1}`);
+  }
+  const corpus = asRecord4(record.corpus, `${source}.corpus`);
+  const execution = asRecord4(record.execution, `${source}.execution`);
+  const subject = asRecord4(execution.subject, `${source}.execution.subject`);
+  const mode = execution.mode;
+  if (mode !== "machinery-only" && mode !== "model-required") {
+    throw new Error(`${source}.execution.mode: expected machinery-only or model-required`);
+  }
+  const subjectKind = subject.kind;
+  if (subjectKind !== "main-agent" && subjectKind !== "worker") {
+    throw new Error(`${source}.execution.subject.kind: expected main-agent or worker`);
+  }
+  const toolTarget = execution.toolTarget;
+  if (toolTarget !== "available" && toolTarget !== "none") {
+    throw new Error(`${source}.execution.toolTarget: expected available or none`);
+  }
+  const expectedBehavior = parseRules(record.expectedBehavior, `${source}.expectedBehavior`);
+  const forbiddenBehavior = parseRules(record.forbiddenBehavior, `${source}.forbiddenBehavior`);
+  const ruleIds = /* @__PURE__ */ new Set();
+  for (const rule of [...expectedBehavior, ...forbiddenBehavior]) {
+    if (ruleIds.has(rule.id)) throw new Error(`${source}: duplicate behavioral rule id ${rule.id}`);
+    ruleIds.add(rule.id);
+  }
+  if (ruleIds.size === 0) throw new Error(`${source}: expected at least one behavioral rule`);
+  const judge = asRecord4(record.judge, `${source}.judge`);
+  const maxEvidenceItems = readBoundedInteger(judge.maxEvidenceItems, `${source}.judge.maxEvidenceItems`, 1, MAX_FACTS);
+  const maxExplanationChars = readBoundedInteger(
+    judge.maxExplanationChars,
+    `${source}.judge.maxExplanationChars`,
+    1,
+    MAX_EXPLANATION_CHARS
+  );
+  return {
+    schema: EVAL_BEHAVIOR_SCENARIO_SCHEMA_V1,
+    corpus: {
+      id: readId(corpus.id, `${source}.corpus.id`),
+      version: readText(corpus.version, `${source}.corpus.version`, MAX_ID_CHARS)
+    },
+    execution: {
+      mode,
+      subject: { kind: subjectKind, role: readId(subject.role, `${source}.execution.subject.role`) },
+      toolTarget
+    },
+    expectedBehavior,
+    forbiddenBehavior,
+    judge: { maxEvidenceItems, maxExplanationChars }
+  };
+}
+function canonicalizeEvalBehaviorJudgeInputV1(value, scenario, source = "behavioral judge input") {
+  const record = asRecord4(value, source);
+  if (!Array.isArray(record.facts)) throw new Error(`${source}.facts: expected array`);
+  if (record.facts.length > scenario.judge.maxEvidenceItems || record.facts.length > MAX_FACTS) {
+    throw new Error(`${source}.facts: exceeds bounded evidence limit`);
+  }
+  const facts = record.facts.map((fact, index) => parseFact(fact, `${source}.facts[${index}]`));
+  const factIds = /* @__PURE__ */ new Set();
+  const factKeys = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (factIds.has(fact.id)) throw new Error(`${source}: duplicate fact id ${fact.id}`);
+    const key = `${fact.source}\0${fact.key}`;
+    if (factKeys.has(key)) throw new Error(`${source}: conflicting fact ${fact.source}.${fact.key}`);
+    factIds.add(fact.id);
+    factKeys.add(key);
+  }
+  const unavailableSources = parseSources(record.unavailableSources, `${source}.unavailableSources`);
+  const infrastructureFailure = record.infrastructureFailure;
+  if (typeof infrastructureFailure !== "boolean") {
+    throw new Error(`${source}.infrastructureFailure: expected boolean`);
+  }
+  const input = {
+    facts: facts.sort((left, right) => left.source.localeCompare(right.source) || left.key.localeCompare(right.key)),
+    unavailableSources: [...new Set(unavailableSources)].sort(),
+    infrastructureFailure
+  };
+  return { input, digest: sha256(stableJson(input)) };
+}
+function judgeEvalBehaviorV1(scenarioValue, verdict, inputValue) {
+  const scenario = parseEvalBehaviorScenarioV1(scenarioValue);
+  const { input, digest } = canonicalizeEvalBehaviorJudgeInputV1(inputValue, scenario);
+  const labels = EVAL_BEHAVIOR_CATEGORIES.map(
+    (category) => judgeCategory(category, scenario, input, scenario.judge.maxExplanationChars)
+  );
+  const outcome = input.infrastructureFailure ? "infrastructure_failure" : labels.some((label) => label.label === "violated") ? "behavioral_failure" : labels.some((label) => label.label === "unknown") ? "unknown" : labels.every((label) => label.label === "unmeasured") ? "unmeasured" : "pass";
+  return parseEvalBehaviorVerdictV1({
+    schema: EVAL_BEHAVIOR_SCHEMA_V1,
+    verdictRef: {
+      schema: verdict.schema,
+      scenarioId: verdict.scenarioId,
+      trialIndex: verdict.trialIndex
+    },
+    corpus: scenario.corpus,
+    judgeInputDigest: digest,
+    outcome,
+    labels
+  });
+}
+function parseEvalBehaviorVerdictV1(value, source = "behavioral verdict") {
+  const record = asRecord4(value, source);
+  if (normalizeEvalSchemaId(record.schema) !== EVAL_BEHAVIOR_SCHEMA_V1)
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_SCHEMA_V1}`);
+  const verdictRef = asRecord4(record.verdictRef, `${source}.verdictRef`);
+  if (normalizeEvalSchemaId(verdictRef.schema) !== EVAL_VERDICT_SCHEMA_V1) {
+    throw new Error(`${source}.verdictRef.schema: expected ${EVAL_VERDICT_SCHEMA_V1}`);
+  }
+  const corpus = asRecord4(record.corpus, `${source}.corpus`);
+  const outcome = readOutcome2(record.outcome, `${source}.outcome`);
+  if (!Array.isArray(record.labels)) throw new Error(`${source}.labels: expected array`);
+  const labels = record.labels.map((label, index) => parseLabel(label, `${source}.labels[${index}]`));
+  const categories = labels.map((label) => label.category);
+  if (labels.length !== EVAL_BEHAVIOR_CATEGORIES.length || new Set(categories).size !== EVAL_BEHAVIOR_CATEGORIES.length) {
+    throw new Error(`${source}.labels: expected every behavioral category exactly once`);
+  }
+  for (const category of EVAL_BEHAVIOR_CATEGORIES) {
+    if (!categories.includes(category)) throw new Error(`${source}.labels: missing category ${category}`);
+  }
+  const derived = deriveOutcome(labels, outcome === "infrastructure_failure");
+  if (outcome !== derived) throw new Error(`${source}.outcome: ${outcome} conflicts with labels (expected ${derived})`);
+  return {
+    schema: EVAL_BEHAVIOR_SCHEMA_V1,
+    verdictRef: {
+      schema: EVAL_VERDICT_SCHEMA_V1,
+      scenarioId: readId(verdictRef.scenarioId, `${source}.verdictRef.scenarioId`),
+      trialIndex: readBoundedInteger(verdictRef.trialIndex, `${source}.verdictRef.trialIndex`, 0, Number.MAX_SAFE_INTEGER)
+    },
+    corpus: {
+      id: readId(corpus.id, `${source}.corpus.id`),
+      version: readText(corpus.version, `${source}.corpus.version`, MAX_ID_CHARS)
+    },
+    judgeInputDigest: readDigest2(record.judgeInputDigest, `${source}.judgeInputDigest`),
+    outcome,
+    labels
+  };
+}
+function assertEvalBehaviorReferencesVerdictV1(behavior, verdict, source = "behavioral verdict") {
+  if (behavior.verdictRef.scenarioId !== verdict.scenarioId || behavior.verdictRef.trialIndex !== verdict.trialIndex) {
+    throw new Error(`${source}.verdictRef: conflicts with result verdict identity`);
+  }
+  if (verdict.machinery === "infrastructure_failure" && behavior.outcome !== "infrastructure_failure") {
+    throw new Error(`${source}.outcome: machinery failure must remain infrastructure_failure`);
+  }
+  if (behavior.outcome === "pass" && verdict.outcome !== "pass") {
+    throw new Error(`${source}.outcome: behavioral pass cannot override a failed or unmeasured result`);
+  }
+}
+function judgeCategory(category, scenario, input, maxExplanationChars) {
+  const expected = scenario.expectedBehavior.filter((rule) => rule.category === category);
+  const forbidden = scenario.forbiddenBehavior.filter((rule) => rule.category === category);
+  const rules = [...expected, ...forbidden];
+  if (input.infrastructureFailure)
+    return labelResult(category, "unknown", rules, [], "infrastructure failure", maxExplanationChars);
+  if (rules.length === 0) return labelResult(category, "unmeasured", [], [], null, maxExplanationChars);
+  const unavailable = rules.some((rule) => input.unavailableSources.includes(rule.fact.source));
+  if (unavailable)
+    return labelResult(category, "unmeasured", rules, [], "required evidence source unavailable", maxExplanationChars);
+  const evaluations = rules.map((rule) => {
+    const fact = input.facts.find(
+      (candidate) => candidate.source === rule.fact.source && candidate.key === rule.fact.key
+    );
+    if (fact === void 0) return { rule, fact: null, holds: null };
+    const matches = compare(fact.value, rule.fact.op, rule.fact.value);
+    return { rule, fact, holds: expected.includes(rule) ? matches : !matches };
+  });
+  const evidence = evaluations.flatMap(({ fact }) => fact === null ? [] : [toEvidence(fact)]).slice(0, MAX_EVIDENCE_PER_LABEL);
+  if (evaluations.some(({ holds }) => holds === false)) {
+    return labelResult(category, "violated", rules, evidence, "one or more declared rules failed", maxExplanationChars);
+  }
+  if (evaluations.some(({ holds }) => holds === null)) {
+    return labelResult(category, "unknown", rules, evidence, "required observable fact missing", maxExplanationChars);
+  }
+  return labelResult(category, "satisfied", rules, evidence, null, maxExplanationChars);
+}
+function labelResult(category, label, rules, evidence, explanation, maxExplanationChars) {
+  return {
+    category,
+    label,
+    ruleIds: rules.map((rule) => rule.id).sort(),
+    evidence,
+    explanation: explanation === null ? null : explanation.slice(0, maxExplanationChars)
+  };
+}
+function deriveOutcome(labels, infrastructure) {
+  if (infrastructure) return "infrastructure_failure";
+  if (labels.some((label) => label.label === "violated")) return "behavioral_failure";
+  if (labels.some((label) => label.label === "unknown")) return "unknown";
+  if (labels.every((label) => label.label === "unmeasured")) return "unmeasured";
+  return "pass";
+}
+function parseRules(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  if (value.length > MAX_RULES) throw new Error(`${source}: exceeds ${MAX_RULES} rules`);
+  return value.map((entry, index) => {
+    const record = asRecord4(entry, `${source}[${index}]`);
+    const fact = asRecord4(record.fact, `${source}[${index}].fact`);
+    const rationale = record.rationale === void 0 ? void 0 : readText(record.rationale, `${source}[${index}].rationale`, MAX_TEXT_CHARS);
+    return {
+      id: readId(record.id, `${source}[${index}].id`),
+      category: readCategory(record.category, `${source}[${index}].category`),
+      fact: {
+        source: readSource(fact.source, `${source}[${index}].fact.source`),
+        key: readText(fact.key, `${source}[${index}].fact.key`, MAX_TEXT_CHARS),
+        op: readOp(fact.op, `${source}[${index}].fact.op`),
+        value: readScalar(fact.value, `${source}[${index}].fact.value`)
+      },
+      ...rationale === void 0 ? {} : { rationale }
+    };
+  });
+}
+function parseFact(value, source) {
+  const record = asRecord4(value, source);
+  const evidence = asRecord4(record.evidence, `${source}.evidence`);
+  return {
+    id: readId(record.id, `${source}.id`),
+    source: readSource(record.source, `${source}.source`),
+    key: readText(record.key, `${source}.key`, MAX_TEXT_CHARS),
+    value: readScalar(record.value, `${source}.value`),
+    evidence: {
+      locator: readText(evidence.locator, `${source}.evidence.locator`, MAX_TEXT_CHARS),
+      digest: readDigest2(evidence.digest, `${source}.evidence.digest`),
+      excerpt: evidence.excerpt === null ? null : readText(evidence.excerpt, `${source}.evidence.excerpt`, MAX_TEXT_CHARS)
+    }
+  };
+}
+function parseLabel(value, source) {
+  const record = asRecord4(value, source);
+  const label = record.label;
+  if (label !== "satisfied" && label !== "violated" && label !== "unknown" && label !== "unmeasured") {
+    throw new Error(`${source}.label: expected satisfied, violated, unknown, or unmeasured`);
+  }
+  if (!Array.isArray(record.ruleIds) || !Array.isArray(record.evidence)) {
+    throw new Error(`${source}: expected ruleIds and evidence arrays`);
+  }
+  if (record.evidence.length > MAX_EVIDENCE_PER_LABEL) throw new Error(`${source}.evidence: exceeds bounded limit`);
+  if ((label === "satisfied" || label === "violated") && (record.ruleIds.length === 0 || record.evidence.length === 0)) {
+    throw new Error(`${source}: ${label} label requires a rule and observable evidence`);
+  }
+  const explanation = record.explanation;
+  if (explanation !== null && (typeof explanation !== "string" || explanation.length > MAX_EXPLANATION_CHARS)) {
+    throw new Error(`${source}.explanation: expected bounded string or null`);
+  }
+  return {
+    category: readCategory(record.category, `${source}.category`),
+    label,
+    ruleIds: record.ruleIds.map((id, index) => readId(id, `${source}.ruleIds[${index}]`)),
+    evidence: record.evidence.map((entry, index) => {
+      const evidence = asRecord4(entry, `${source}.evidence[${index}]`);
+      return {
+        factId: readId(evidence.factId, `${source}.evidence[${index}].factId`),
+        source: readSource(evidence.source, `${source}.evidence[${index}].source`),
+        locator: readText(evidence.locator, `${source}.evidence[${index}].locator`, MAX_TEXT_CHARS),
+        digest: readDigest2(evidence.digest, `${source}.evidence[${index}].digest`),
+        excerpt: evidence.excerpt === null ? null : readText(evidence.excerpt, `${source}.evidence[${index}].excerpt`, MAX_TEXT_CHARS)
+      };
+    }),
+    explanation
+  };
+}
+function toEvidence(fact) {
+  return { factId: fact.id, source: fact.source, ...fact.evidence };
+}
+function compare(actual, op, expected) {
+  if (op === "eq") return actual === expected;
+  if (op === "neq") return actual !== expected;
+  if (typeof actual !== "number" || typeof expected !== "number") return false;
+  if (op === "lt") return actual < expected;
+  if (op === "lte") return actual <= expected;
+  if (op === "gt") return actual > expected;
+  return actual >= expected;
+}
+function parseSources(value, source) {
+  if (!Array.isArray(value)) throw new Error(`${source}: expected array`);
+  return value.map((entry, index) => readSource(entry, `${source}[${index}]`));
+}
+function readOutcome2(value, source) {
+  if (value === "pass" || value === "behavioral_failure" || value === "unknown" || value === "unmeasured" || value === "infrastructure_failure")
+    return value;
+  throw new Error(`${source}: expected a closed behavioral outcome`);
+}
+function readCategory(value, source) {
+  if (typeof value === "string" && EVAL_BEHAVIOR_CATEGORIES.includes(value)) {
+    return value;
+  }
+  throw new Error(`${source}: expected a closed behavioral category`);
+}
+function readSource(value, source) {
+  if (value === "transcript" || value === "tool" || value === "receipt" || value === "grader") return value;
+  throw new Error(`${source}: expected transcript, tool, receipt, or grader`);
+}
+function readOp(value, source) {
+  if (value === "eq" || value === "neq" || value === "lt" || value === "lte" || value === "gt" || value === "gte") {
+    return value;
+  }
+  throw new Error(`${source}: expected eq, neq, lt, lte, gt, or gte`);
+}
+function readScalar(value, source) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.length <= MAX_TEXT_CHARS) return value;
+  throw new Error(`${source}: expected bounded string, finite number, or boolean`);
+}
+function readId(value, source) {
+  const id = readText(value, source, MAX_ID_CHARS);
+  if (!/^[A-Za-z0-9._-]+$/u.test(id)) throw new Error(`${source}: expected stable id`);
+  return id;
+}
+function readText(value, source, maxChars) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.length > maxChars) {
+    throw new Error(`${source}: expected non-empty string no longer than ${maxChars} characters`);
+  }
+  return value;
+}
+function readDigest2(value, source) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/u.test(value)) throw new Error(`${source}: expected sha256 digest`);
+  return value;
+}
+function readBoundedInteger(value, source, min, max) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < min || value > max) {
+    throw new Error(`${source}: expected integer from ${min} through ${max}`);
+  }
+  return value;
+}
+function asRecord4(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+function stableJson(value) {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+
+// src/domains/eval/schema/behavioral-metrics.ts
+init_esm_shims();
+var EVAL_BEHAVIOR_METRICS_SCHEMA_V1 = "clio-coder.eval.behavior.metrics.v1";
+var EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1 = [
+  {
+    name: "correctness.taskSolved",
+    family: "correctness",
+    direction: "higher",
+    hardGate: true,
+    source: "grader"
+  },
+  {
+    name: "safety.violations",
+    family: "safety",
+    direction: "lower",
+    hardGate: true,
+    source: "behavioral-label"
+  },
+  {
+    name: "behavior.labelViolations",
+    family: "behavior",
+    direction: "lower",
+    hardGate: false,
+    source: "behavioral-label"
+  },
+  {
+    name: "efficiency.toolCalls",
+    family: "efficiency",
+    direction: "lower",
+    hardGate: false,
+    source: "tool-event"
+  },
+  {
+    name: "exploration.unnecessaryReads",
+    family: "exploration",
+    direction: "lower",
+    hardGate: false,
+    source: "tool-event"
+  },
+  {
+    name: "delegation.quality",
+    family: "delegation",
+    direction: "higher",
+    hardGate: false,
+    source: "behavioral-label"
+  },
+  {
+    name: "claims.unsupported",
+    family: "claims",
+    direction: "lower",
+    hardGate: false,
+    source: "grader"
+  },
+  {
+    name: "tokens.total",
+    family: "tokens",
+    direction: "lower",
+    hardGate: false,
+    source: "runner"
+  },
+  {
+    name: "latency.wallMs",
+    family: "latency",
+    direction: "lower",
+    hardGate: false,
+    source: "runner"
+  },
+  {
+    name: "cost.usd",
+    family: "cost",
+    direction: "lower",
+    hardGate: false,
+    source: "receipt"
+  }
+];
+function buildEvalBehaviorMetricsV1(result, role) {
+  const label = (category) => result.behavioral?.labels.find((entry) => entry.category === category)?.label ?? null;
+  const observedLabels = result.behavioral?.labels.filter(
+    (entry) => entry.label === "satisfied" || entry.label === "violated"
+  );
+  const values = {
+    "correctness.taskSolved": booleanMetric(result.metrics["task.solved"]),
+    "safety.violations": violationMetric(label("safety_comprehension")),
+    "behavior.labelViolations": observedLabels === void 0 || observedLabels.length !== result.behavioral?.labels.length ? null : observedLabels.filter((entry) => entry.label === "violated").length,
+    "efficiency.toolCalls": numberMetric(result.metrics["tools.totalCalls"]),
+    "exploration.unnecessaryReads": numberMetric(result.metrics["tools.read.outsideAllowed"]),
+    "delegation.quality": qualityMetric(label("delegation")),
+    "claims.unsupported": numberMetric(result.metrics["claims.unsupported"]),
+    "tokens.total": numberMetric(result.metrics["tokens.total"]),
+    "latency.wallMs": numberMetric(result.metrics["latency.wallMs"]),
+    "cost.usd": numberMetric(result.metrics["cost.usd"])
+  };
+  const metrics = Object.fromEntries(
+    EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => [
+      definition.name,
+      { value: values[definition.name], source: definition.source }
+    ])
+  );
+  return {
+    schema: EVAL_BEHAVIOR_METRICS_SCHEMA_V1,
+    scenarioId: result.taskId,
+    role,
+    target: { id: result.target.id, model: result.target.model },
+    metrics
+  };
+}
+function parseEvalBehaviorMetricsV1(value, source = "behavioral metrics") {
+  const record = asRecord5(value, source);
+  if (normalizeEvalSchemaId(record.schema) !== EVAL_BEHAVIOR_METRICS_SCHEMA_V1) {
+    throw new Error(`${source}.schema: expected ${EVAL_BEHAVIOR_METRICS_SCHEMA_V1}`);
+  }
+  const target = asRecord5(record.target, `${source}.target`);
+  const rawMetrics = asRecord5(record.metrics, `${source}.metrics`);
+  const expectedMetricNames = new Set(EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => definition.name));
+  for (const metricName of Object.keys(rawMetrics)) {
+    if (!expectedMetricNames.has(metricName)) {
+      throw new Error(`${source}.metrics.${metricName}: unknown behavioral metric`);
+    }
+  }
+  const metrics = Object.fromEntries(
+    EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1.map((definition) => {
+      const observation = asRecord5(rawMetrics[definition.name], `${source}.metrics.${definition.name}`);
+      const metricSource = observation.source;
+      if (metricSource !== definition.source) {
+        throw new Error(`${source}.metrics.${definition.name}.source: expected ${definition.source}`);
+      }
+      const metricValue = observation.value;
+      if (metricValue !== null && (typeof metricValue !== "number" || !Number.isFinite(metricValue))) {
+        throw new Error(`${source}.metrics.${definition.name}.value: expected finite number or null`);
+      }
+      return [definition.name, { value: metricValue, source: metricSource }];
+    })
+  );
+  return {
+    schema: EVAL_BEHAVIOR_METRICS_SCHEMA_V1,
+    scenarioId: readString4(record.scenarioId, `${source}.scenarioId`),
+    role: readString4(record.role, `${source}.role`),
+    target: {
+      id: readString4(target.id, `${source}.target.id`),
+      model: target.model === null ? null : readString4(target.model, `${source}.target.model`)
+    },
+    metrics
+  };
+}
+function numberMetric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function booleanMetric(value) {
+  return typeof value === "boolean" ? value ? 1 : 0 : null;
+}
+function violationMetric(label) {
+  if (label === "violated") return 1;
+  if (label === "satisfied") return 0;
+  return null;
+}
+function qualityMetric(label) {
+  if (label === "satisfied") return 1;
+  if (label === "violated") return 0;
+  return null;
+}
+function asRecord5(value, source) {
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+function readString4(value, source) {
+  if (typeof value === "string" && value.length > 0) return value;
+  throw new Error(`${source}: expected non-empty string`);
+}
+
+// src/domains/eval/artifacts/store.ts
+function evalArtifactPathV4(dataDir, evalId) {
+  assertSafeId(evalId, "eval");
+  return join2(evalRoot(dataDir), `${evalId}.json`);
+}
+async function writeEvalArtifactV4(dataDir, artifact, out) {
+  const path = out === void 0 ? evalArtifactPathV4(dataDir, artifact.evalId) : out.endsWith(".json") ? out : join2(out, `${artifact.evalId}.json`);
+  safeResourceWrite(path, `${JSON.stringify(redactArtifactForStorage(artifact), null, 2)}
+`, { encoding: "utf8" });
+  return path;
+}
+async function loadEvalArtifactV4(dataDir, evalId) {
+  let raw;
+  try {
+    raw = await readFile2(evalArtifactPathV4(dataDir, evalId), "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") throw new Error(`eval artifact not found: ${evalId}`);
+    throw error;
+  }
+  return parseEvalArtifactV4(JSON.parse(raw), evalId);
+}
+function parseEvalArtifactV4(value, source) {
+  if (!isRecord2(value)) throw new Error(`${source}: expected object`);
+  if (value.version !== 4) throw new Error(`${source}.version: expected current version 4`);
+  const summary = asRecord6(value.summary, `${source}.summary`);
+  const matrix = asRecord6(value.matrix, `${source}.matrix`);
+  const suite = asRecord6(value.suite, `${source}.suite`);
+  const servingConfiguration = value.servingConfiguration === void 0 ? void 0 : parseEvalServingConfigurationV1(value.servingConfiguration, `${source}.servingConfiguration`);
+  const aggregates = value.aggregates === void 0 ? void 0 : readArray2(value, source, "aggregates");
+  const clioCoder = asRecord6(value.clioCoder ?? value.clio, `${source}.clioCoder`);
+  return {
+    version: 4,
+    evalId: readString5(value, source, "evalId"),
+    suite: { id: readString5(suite, `${source}.suite`, "id"), hash: readString5(suite, `${source}.suite`, "hash") },
+    clioCoder: {
+      version: readString5(clioCoder, `${source}.clioCoder`, "version"),
+      commit: readNullableString5(clioCoder, `${source}.clioCoder`, "commit"),
+      entry: readString5(clioCoder, `${source}.clioCoder`, "entry")
+    },
+    environment: {
+      platform: readString5(asRecord6(value.environment, `${source}.environment`), `${source}.environment`, "platform"),
+      node: readString5(asRecord6(value.environment, `${source}.environment`), `${source}.environment`, "node")
+    },
+    matrix: {
+      target: readString5(matrix, `${source}.matrix`, "target"),
+      model: readNullableString5(matrix, `${source}.matrix`, "model"),
+      thinking: readNullableString5(matrix, `${source}.matrix`, "thinking"),
+      ...matrix.dimensions === void 0 ? {} : { dimensions: parseEvalExecutionMatrixDimensionsV1(matrix.dimensions, `${source}.matrix.dimensions`) }
+    },
+    ...servingConfiguration === void 0 ? {} : { servingConfiguration },
+    summary: {
+      runs: readNumber2(summary, `${source}.summary`, "runs"),
+      passed: readNumber2(summary, `${source}.summary`, "passed"),
+      failed: readNumber2(summary, `${source}.summary`, "failed"),
+      passRate: readNumber2(summary, `${source}.summary`, "passRate"),
+      tokens: parseTokenAccounting(summary.tokens, `${source}.summary.tokens`),
+      wallTimeMs: readNumber2(summary, `${source}.summary`, "wallTimeMs")
+    },
+    ...aggregates === void 0 ? {} : { aggregates },
+    results: readArray2(value, source, "results").map((entry, index) => parseResult(entry, `${source}.results[${index}]`))
+  };
+}
+function parseTokenAccounting(value, source) {
+  const record = asRecord6(value, source);
+  const measured = readBoolean2(record, source, "measured");
+  const runs = readNumber2(record, source, "runs");
+  const measuredRuns = readNumber2(record, source, "measuredRuns");
+  const countFields = ["input", "output", "total", "cacheRead", "cacheWrite"];
+  if (!measured) {
+    if (measuredRuns !== 0) throw new Error(`${source}.measuredRuns: expected 0 when unmeasured`);
+    const present = countFields.filter((field) => field in record);
+    if (present.length > 0) throw new Error(`${source}: unmeasured accounting carries no counts (${present.join(", ")})`);
+    return { measured: false, runs, measuredRuns: 0 };
+  }
+  if (measuredRuns <= 0) throw new Error(`${source}.measuredRuns: expected a positive count when measured`);
+  return {
+    measured: true,
+    runs,
+    measuredRuns,
+    input: readNumber2(record, source, "input"),
+    output: readNumber2(record, source, "output"),
+    total: readNumber2(record, source, "total"),
+    cacheRead: readNumber2(record, source, "cacheRead"),
+    cacheWrite: readNumber2(record, source, "cacheWrite")
+  };
+}
+function parseResult(value, source) {
+  const record = asRecord6(value, source);
+  const target = asRecord6(record.target, `${source}.target`);
+  const verdict = record.verdict === void 0 ? void 0 : parseEvalVerdictEnvelopeV1(record.verdict, `${source}.verdict`);
+  const behavioral = record.behavioral === void 0 ? void 0 : parseEvalBehaviorVerdictV1(record.behavioral, `${source}.behavioral`);
+  const behavioralMetrics = record.behavioralMetrics === void 0 ? void 0 : parseEvalBehaviorMetricsV1(record.behavioralMetrics, `${source}.behavioralMetrics`);
+  const executionEnvelope = record.executionEnvelope === void 0 ? void 0 : parseEvalExecutionEnvelopeV1(record.executionEnvelope, `${source}.executionEnvelope`);
+  if (behavioral !== void 0 && verdict === void 0) {
+    throw new Error(`${source}.behavioral: sibling document requires a verdict`);
+  }
+  if (behavioral !== void 0 && verdict !== void 0) {
+    assertEvalBehaviorReferencesVerdictV1(behavioral, verdict, `${source}.behavioral`);
+  }
+  if (behavioralMetrics !== void 0) {
+    if (behavioral === void 0) throw new Error(`${source}.behavioralMetrics: requires a behavioral verdict`);
+    if (behavioralMetrics.scenarioId !== readString5(record, source, "taskId")) {
+      throw new Error(`${source}.behavioralMetrics.scenarioId: conflicts with result taskId`);
+    }
+    if (behavioralMetrics.target.id !== readString5(target, `${source}.target`, "id") || behavioralMetrics.target.model !== readNullableString5(target, `${source}.target`, "model")) {
+      throw new Error(`${source}.behavioralMetrics.target: conflicts with result target`);
+    }
+  }
+  if (executionEnvelope !== void 0) {
+    if (behavioral === void 0) throw new Error(`${source}.executionEnvelope: requires a behavioral verdict`);
+    if (executionEnvelope.target !== readString5(target, `${source}.target`, "id") || executionEnvelope.corpus.id !== behavioral.corpus.id || executionEnvelope.corpus.version !== behavioral.corpus.version) {
+      throw new Error(`${source}.executionEnvelope: conflicts with result target or behavioral corpus`);
+    }
+  }
+  return {
+    assignmentId: readNullableString5(record, source, "assignmentId"),
+    terminalReceiptDigest: readNullableDigest2(record, source, "terminalReceiptDigest"),
+    taskId: readString5(record, source, "taskId"),
+    repeatIndex: readNumber2(record, source, "repeatIndex"),
+    target: {
+      id: readString5(target, `${source}.target`, "id"),
+      model: readNullableString5(target, `${source}.target`, "model"),
+      thinking: readNullableString5(target, `${source}.target`, "thinking")
+    },
+    pass: readBoolean2(record, source, "pass"),
+    failureClass: readNullableString5(record, source, "failureClass"),
+    metrics: asRecord6(record.metrics, `${source}.metrics`),
+    artifacts: asRecord6(record.artifacts, `${source}.artifacts`),
+    ...verdict === void 0 ? {} : { verdict },
+    ...behavioral === void 0 ? {} : { behavioral },
+    ...behavioralMetrics === void 0 ? {} : { behavioralMetrics },
+    ...executionEnvelope === void 0 ? {} : { executionEnvelope }
+  };
+}
+function asRecord6(value, source) {
+  if (isRecord2(value)) return value;
+  throw new Error(`${source}: expected object`);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readString5(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string`);
+  return value;
+}
+function readNullableString5(record, source, field) {
+  const value = record[field];
+  if (value === null) return null;
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${source}.${field}: expected string or null`);
+  return value;
+}
+function readNullableDigest2(record, source, field) {
+  const value = readNullableString5(record, source, field);
+  if (value !== null && !/^[0-9a-f]{64}$/u.test(value))
+    throw new Error(`${source}.${field}: expected sha256 digest or null`);
+  return value;
+}
+function readNumber2(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "number" || !Number.isFinite(value)) throw new Error(`${source}.${field}: expected number`);
+  return value;
+}
+function readBoolean2(record, source, field) {
+  const value = record[field];
+  if (typeof value !== "boolean") throw new Error(`${source}.${field}: expected boolean`);
+  return value;
+}
+function readArray2(record, source, field) {
+  const value = record[field];
+  if (!Array.isArray(value)) throw new Error(`${source}.${field}: expected array`);
+  return value;
+}
+
+export {
+  normalizeEvalSchemaId,
+  normalizeEvalRunnerKind,
+  EVAL_VERDICT_SCHEMA_V1,
+  EVAL_TRACKED_METRIC_NAMES,
+  parseEvalVerdictEnvelopeV1,
+  parseEvalBehaviorScenarioV1,
+  judgeEvalBehaviorV1,
+  assertEvalBehaviorReferencesVerdictV1,
+  EVAL_BEHAVIOR_METRIC_DEFINITIONS_V1,
+  buildEvalBehaviorMetricsV1,
+  EVAL_EXECUTION_ENVELOPE_SCHEMA_V1,
+  EVAL_EXECUTION_MATRIX_DIMENSIONS_V1,
+  parseEvalExecutionMatrixDimensionsV1,
+  evalServingConfigurationOf,
+  sameEvalServingConfiguration,
+  renderEvalServingConfiguration,
+  redactArtifactForStorage,
+  ZERO_EVAL_HARNESS_METRICS,
+  evalHarnessMetricsFromReceipt,
+  sumEvalHarnessMetrics,
+  evalRoot,
+  createEvalId,
+  writeEvalArtifact,
+  loadEvalArtifact,
+  writeEvalArtifactV4,
+  loadEvalArtifactV4,
+  parseEvalArtifactV4
+};
+//# sourceMappingURL=chunk-6CCS4G3W.js.map